An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows orsystemsetup on macOS.[1][2][3] These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.[4][5]
System time information may be gathered in a number of ways, such as withNet on Windows by performingnet time \hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by usingw32tm /tz.[2] In addition, adversaries can discover device uptime through functions such asGetTickCount() to determine how long it has been since the system booted up.[6]
On network devices,Network Device CLI commands such asshow clock detail can be used to see the current time configuration.[7] On ESXi servers,esxcli system clock get can be used for the same purpose.
In addition, system calls – such astime() – have been used to collect the current time on Linux devices.[8] On macOS systems, adversaries may use commands such assystemsetup -gettimezone ortimeIntervalSinceNow to gather current time zone information or current date and time.[9][10]
This information could be useful for performing other techniques, such as executing a file with aScheduled Task/Job[11], or to discover locality information based on time zone to assist in victim targeting (i.e.System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.[12]
| ID | Name | Description |
|---|---|---|
| S0331 | Agent Tesla | Agent Tesla can collect the timestamp from the victim’s machine.[13] |
| S0622 | AppleSeed | AppleSeed can pull a timestamp from the victim's machine.[14] |
| S0373 | Astaroth | Astaroth collects the timestamp from the infected machine.[15] |
| S1053 | AvosLocker | AvosLocker has checked the system time before and after encryption.[16] |
| S0344 | Azorult | Azorult can collect the time zone information from the system.[17][18] |
| S1081 | BADHATCH | BADHATCH can obtain the |
| S0534 | Bazar | |
| S1246 | BeaverTail | BeaverTail has obtained and sent the current timestamp associated with the victim device to C2.[22] |
| S0574 | BendyBear | BendyBear has the ability to determine local time on a compromised host.[23] |
| S0017 | BISCUIT | |
| S0268 | Bisonal | Bisonal can check the system time set on the infected host.[25] |
| S0657 | BLUELIGHT | BLUELIGHT can collect the local time on a compromised host.[26] |
| G0060 | BRONZE BUTLER | BRONZE BUTLER has used |
| S0471 | build_downer | build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.[28] |
| C0015 | C0015 | DuringC0015, the threat actors used the command |
| S0351 | Cannon | Cannon can collect the current time zone information from the victim’s machine.[30] |
| S0335 | Carbon | Carbon uses the command |
| S1043 | ccf32 | ccf32 can determine the local time on targeted machines.[32] |
| G0114 | Chimera | Chimera has used |
| S0660 | Clambling | |
| S0126 | ComRAT | ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).[35] |
| S0608 | Conficker | Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.[36][37] |
| S0115 | Crimson | Crimson has the ability to determine the date and time on a compromised host.[38] |
| G1012 | CURIUM | CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.[39] |
| S1111 | DarkGate | DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename.[40]DarkGate queries victim system epoch time during execution.[40]DarkGate captures system time information as part of automated profiling on initial installation.[41] |
| G0012 | Darkhotel | Darkhotel malware can obtain system time from a compromised host.[42] |
| S0673 | DarkWatchman | DarkWatchman can collect time zone information and system |
| S1033 | DCSrv | DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.[44] |
| S1134 | DEADWOOD | DEADWOOD will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.[45] |
| S0694 | DRATzarus | DRATzarus can use the |
| S1159 | DUSTTRAP | DUSTTRAP reads the infected system's current time and writes it to a log file during execution.[47] |
| S0554 | Egregor | Egregor contains functionality to query the local/system time.[48] |
| S0091 | Epic | Epic uses the |
| S0396 | EvilBunny | EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.[50] |
| S0267 | FELIXROOT | FELIXROOT gathers the time zone information from the victim’s machine.[51] |
| G0046 | FIN7 | FIN7 has used the PowerShell script 3CF9.ps1 to execute |
| S1044 | FunnyDream | FunnyDream can check system time to help determine when changes were made to specified files.[32] |
| S0588 | GoldMax | GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.[53][54] |
| S0531 | Grandoreiro | Grandoreiro can determine the time on the victim machine via IPinfo.[55] |
| S0237 | GravityRAT | GravityRAT can obtain the date and time of a system.[56] |
| S0690 | Green Lambert | Green Lambert can collect the date and time from a compromised host.[57][58] |
| S0417 | GRIFFON | GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.[59] |
| G0126 | Higaisa | |
| S0376 | HOPLIGHT | HOPLIGHT has been observed collecting system time from victim machines.[61] |
| S0260 | InvisiMole | InvisiMole gathers the local system time from the victim’s machine.[62][63] |
| S1051 | KEYPLUG | KEYPLUG can obtain the current tick count of an infected computer.[64] |
| G0032 | Lazarus Group | A Destover-like implant used byLazarus Group can obtain the current system time and send it to the C2 server.[65] |
| S1244 | Medusa Ransomware | Medusa Ransomware has discovered device uptime through |
| S0455 | Metamorfo | |
| S0149 | MoonWind | |
| S0039 | Net | The |
| S1147 | Nightdoor | Nightdoor can identify the system local time information.[70] |
| S0353 | NOKKI | NOKKI can collect the current timestamp of the victim's machine.[71] |
| S0439 | Okrum | Okrum can obtain the date and time of the compromised system.[72] |
| S0264 | OopsIE | OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.[73] |
| C0012 | Operation CuckooBees | DuringOperation CuckooBees, the threat actors used the |
| C0014 | Operation Wocao | DuringOperation Wocao, threat actors used the |
| S1233 | PAKLOG | PAKLOG has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.[76] |
| S0501 | PipeMon | PipeMon can send time zone information from a compromised host to C2.[77] |
| S0013 | PlugX | PlugX has identified system time through its GetSystemInfo command.[78] |
| S0139 | PowerDuke | PowerDuke has commands to get the time the machine was built, the time, and the time zone.[79] |
| S0238 | Proxysvc | As part of the data reconnaissance phase,Proxysvc grabs the system time to send back to the control server.[65] |
| S1228 | PUBLOAD | PUBLOAD has collected the machine’s tick count through the use of |
| S0650 | QakBot | |
| S1148 | Raccoon Stealer | Raccoon Stealer gathers victim machine timezone information.[82][83] |
| S0148 | RTM | |
| S0596 | ShadowPad | ShadowPad has collected the current date and time of the victim system.[85] |
| S0140 | Shamoon | Shamoon obtains the system time and will only activate if it is greater than a preset date.[86][87] |
| S0450 | SHARPSTATS | SHARPSTATS has the ability to identify the current date and time on the compromised host.[88] |
| S1178 | ShrinkLocker | ShrinkLocker retrieves a system timestamp that is used in generating an encryption key.[89] |
| G0121 | Sidewinder | Sidewinder has used tools to obtain the current system time.[90] |
| S0692 | SILENTTRINITY | SILENTTRINITY can collect start time information from a compromised host.[91] |
| S0615 | SombRAT | SombRAT can execute |
| S1227 | StarProxy | StarProxy has utilized the windows API call |
| S0380 | StoneDrill | StoneDrill can obtain the current date and time of the victim machine.[95] |
| S1034 | StrifeWater | StrifeWater can collect the time zone from the victim's machine.[96] |
| S0603 | Stuxnet | Stuxnet collects the time and date of a system when it is infected.[97] |
| S0559 | SUNBURST | |
| S1064 | SVCReady | |
| S0098 | T9000 | T9000 gathers and beacons the system time during installation.[101] |
| S0011 | Taidoor | Taidoor can use |
| S0586 | TAINTEDSCRIBE | TAINTEDSCRIBE can execute |
| S0467 | TajMahal | TajMahal has the ability to determine local time on a compromised host.[104] |
| G0089 | The White Company | The White Company has checked the current date on the victim system.[105] |
| S0678 | Torisma | Torisma can collect the current time on a victim machine.[106] |
| G0010 | Turla | Turla surveys a system upon check-in to discover the system time by using the |
| G1048 | UNC3886 | UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.[107] |
| S0275 | UPPERCUT | UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.[108] |
| G1017 | Volt Typhoon | Volt Typhoon has obtained the victim's system timezone.[109] |
| S0466 | WindTail | WindTail has the ability to generate the current date and time.[110] |
| S0251 | Zebrocy | Zebrocy gathers the current time zone and date information from the system.[111][112] |
| S0330 | Zeus Panda | Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.[113] |
| G0128 | ZIRCONIUM | ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.[114] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0151 | Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery | AN0430 | Untrusted or unusual process/script (cmd.exe, powershell.exe, w32tm.exe, net.exe, custom binaries) queries system time/timezone (e.g., w32tm /tz, net time \host, Get-TimeZone, GetTickCount API) and (optionally) is followed within a short window by time-based scheduling or conditional execution (e.g., schtasks /create, at.exe, PowerShell Start-Sleep with large values). |
| AN0431 | A process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic. | ||
| AN0432 | Process/script execution of systemsetup -gettimezone, date, ioreg, or API usage (timeIntervalSinceNow, gettimeofday) followed by time-based scheduling (launchd plist modification) or sleep-based execution. | ||
| AN0433 | Interactive or remote shell/API invocation of esxcli system clock get or querying time parameters via hostd/vpxa shortly followed by time/ntp configuration checks or scheduled task creation, executed by non-standard accounts or outside maintenance windows. | ||
| AN0434 | Non-standard or rare users/locations issue CLI commands like "show clock detail" or "show timezone"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level. |